Security Bulletin: IBM OpenPages with Watson has addressed Apache Log4j vulnerability (CVE-2022-23307).

Summary

There is a vulnerability in the Apache Log4j open source library used by IBM OpenPages with Watson. This affects the IBM OpenPages logging framework. This vulnerability has been addressed. (CVE-2022-23307).

Vulnerability Details

CVEID:CVE-2022-23307
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the in Apache Chainsaw component. By sending specially-crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217462 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM OpenPages with Watson versions 8.1 through 8.2.0.4.2

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now. Fixes and installation instructions are provided at the URLs listed below:

For IBM OpenPages with Watson 8.1or8.1.0.1

- Upgrade to 8.1.0.2 Fix Pack

- Apply 8.1.0.2 Interim Fix 3 (8.1.0.2.3) or later

|

<https://www.ibm.com/support/pages/openpages-watson-81-fix-pack-2&gt;

<https://ibm.com/support/pages/openpages-watson-8102-interim-fix-3-0&gt;

For IBM OpenPages with Watson8.1.0.2

- Apply 8.1.0.2 Interim Fix 3 (8.1.0.2.3) or later

|

<https://ibm.com/support/pages/openpages-watson-8102-interim-fix-3-0&gt;

For IBM OpenPages with Watson8.2,8.2.0.1, 8.2.0.2 or 8.2.0.3

- Upgrade to 8.2.0.4 Fix Pack

- Apply 8.2.0.4 Interim Fix 3 (8.2.0.4.3) or later

|

<https://www.ibm.com/support/pages/openpages-watson-82-fix-pack-4&gt;

<https://www.ibm.com/support/pages/openpages-watson-8204-interim-fix-3&gt;

IBM recommends to use the latest Interim Fix (IF). As of July 19, 2022, the latest Interim Fix is 8.2.0.4.6. Here is the link for more information:

<https://www.ibm.com/support/pages/openpages-watson-8204-interim-fix-6&gt;

For IBM OpenPages with Watson** 8.2.0.4**

- Apply 8.2.0.4 Interim Fix 3 (8.2.0.4.3) or later

|

<https://www.ibm.com/support/pages/openpages-watson-8204-interim-fix-3&gt;

IBM recommends to use the latest Interim Fix (IF). As of July 19, 2022, the latest Interim Fix is 8.2.0.4.6. Here is the link for more information:

<https://www.ibm.com/support/pages/openpages-watson-8204-interim-fix-6&gt;

Workarounds and Mitigations

None